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WHAT IS CLAIMED IS : 

1 . A method for prioritizing event datum received from a plurality of asynchronous 
telemetric streams within a system, the method comprising: 
receiving an event from one of the streams; 

determining whether a value of the event is less than a previously recorded 
minimum value for the stream, and if the value of the event is less than the previously 
recorded minimum value, updating the recorded minimum value to the value of the event; 

determining whether the value of the event is greater than a previously recorded 
maximum value for the stream, and if the value of the event is greater than the previously 
recorded, updating the recorded maximum value to the value of the event; 

generating a normalized event value based upon the value of the event, the 
recorded minimum value, and the recorded maximum value; 

determining a system threat level as a percentage of the streams that exhibit an 
alarm state; 

calculating a normalized rate of change of the stream; 

calculating a first exponential average based upon the determined threat level and 
a threat level previously stored in a first table providing a correlation between system 
threat levels and normalized event values; 

calculating a second exponential average based upon the determined threat level 
and a threat level previously stored in a second table providing a correlation between 
system threat levels and normalized stream rates of change; and 
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calculating a priority of the stream based upon a predetermined relationship 
between the first exponential average, the second exponential average, and an alarm 
status indicator associated with the stream. 

2. The method of claim 1, wherein 

the first exponential average comprises a number in a range from 0 to 100, the 
second exponential average comprises a number in a range from 0 to 100, and the alarm 
status indicator comprises either 1 or 0; and 

calculating a priority of the stream comprises dividing the sum of the first 
exponential average and second exponential average by 4 and adding to a resulting value 
a product of the alarm status indicator and 50. 

3. The method of claim 1, wherein the predetermined relationship between 
the first exponential average, the second exponential average, and the alarm status 
indicator provides for predetermined weightings of the first exponential average, the 
second exponential average, and the alarm status indicator. 

4. A method for prioritizing event datum received from a plurality of streams 
within a system, the method comprising: 

receiving an event value from a stream; 

generating a normalized event value based upon the received event value; 
calculating a normalized rate of change of the stream; 
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determining a system threat level based upon a number of alarm status indications 
associated with the plurality of streams; 

calculating a first exponential average based upon the determined threat level and 
a threat level previously stored in a first table providing a correlation between system 
threat levels and normalized event values; 

calculating a second exponential average based upon the determined threat level 
and a threat level previously stored in a second table providing a correlation between 
system threat levels and normalized stream rates of change; and 

calculating a priority of the stream based upon a predetermined relationship 
between the first exponential average, the second exponential average, and an alarm 
status indicator associated with the stream. 

5. A method for prioritizing event datum received from a plurality of streams 
within a system, the method comprising: 

receiving an event from one of the streams; 
determining a current state of system health; 

generating a current normalized event value and a current normalized stream rate 
of change value; and 

defining a priority for the stream based upon a predetermined relationship 
between the current state of system health, the current normalized event value, the current 
normalized stream rate of change value, previously stored normalized event values, 
previously stored stream rate of change values, and an alarm status indicator associated 
with the stream. 
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6. The method of claim 5 wherein defining a priority further comprises: 
calculating a first exponential average based upon the current state of system 

health and a state of system health previously stored in a first table providing a 
correlation between system health and normalized event values; 

calculating a second exponential average based upon the current state of system 
health and a state of system health previously stored in a second table providing a 
correlation between system threat levels and normalized stream rates of change; and 

calculating a priority of the stream based upon a predetermined relationship 
between the first exponential average, the second exponential average, and the alarm 
status indicator associated with the stream. 

7. The method of claim 6, wherein 

the first exponential average comprises a number in a range from 0 to 100, the 
second exponential average comprises a number in a range from 0 to 100, and the alarm 
status indicator comprises either 1 or 0; and 

the calculating a priority of the stream comprises dividing the sum of the first 
exponential average and second exponential average by 4 and adding to a resulting value 
a product of the alarm status indicator and 50. 

8. A computer program product for use in an event monitoring system, the 
computer program product comprising instructions that, when executed by a processor, 
cause the processor to: 
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get an event from a stream selected from a plurality of streams; 

determine a current normalized event value and a current normalized rate of 
change of event values for the stream; 

determine a level of current system health; 

evaluate a historic relationship between levels of system health, normalized event 
values for the stream, and normalized rates of change of event values for the stream; 

predict an effect upon system health that is likely to occur based upon the 
determined current normalized event value for the stream, the determined current 
normalized rate of change of event values for the stream, and the evaluated historic 
relationship; and 

determine a priority for the event based upon the predicted effect. 

9. An event monitoring system comprising: 
a plurality of asynchronous telemetric streams; 

a nexus coupled to the plurality of asynchronous telemetric streams; and 
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a processor associated with the nexus, the processor being configured to 
implement a historic learning methodology for assigning priorities to events received at 
the nexus from the streams. 

10. An event monitoring system comprising: 

a nexus for receiving a plurality of events generated by a corresponding plurality 
of asynchronous telemetric streams, and 

means for assigning priority to the received events based upon a historic learning 
analysis. 

11. An event prioritization system for using in monitoring a plurality of data 
streams generated by a communications network, the event prioritization system 
comprising: 

a plurality of agent applications for monitoring selected parameters descriptive of 
a functionality of the communications network, each such agent generating an 
independent data stream and delivering the generated stream to a common nexus, and 
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a processor associated with the common nexus, the processor being configured to 
execute a historic learning algorithm to assign priorities to event datum received from the 
data streams generated by the agents. 

12. The event prioritization system of claim 1 1 , wherein the processor 
executes a set of programming instructions for causing the processor to 

receive an event from one of the streams; 

determine whether a value of the event is less than a previously recorded 
minimum value for the stream, and if the value of the event is less than the previously 
recorded minimum value, update the recorded minimum value to the value of the event; 

determine whether the value of the event is greater than a previously recorded 
maximum value for the stream, and if the value of the event is greater than the previously 
recorded, update the recorded minimum value to the value of the event; 

generate a normalized event value based upon the value of the event, the recorded 
minimum value, and the recorded maximum value; 

determine a system threat level as a percentage of the streams that exhibit an 
alarm state; 

calculate a normalized rate of change of the stream; 

calculate a first exponential average based upon the determined threat level and a 
threat level previously stored in a first table providing a correlation between system threat 
levels and normalized event values; 
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calculate a second exponential average based upon the determined threat level and 
a threat level previously stored in a second table providing a correlation between system 
threat levels and normalized stream rates of change; and 

calculate a priority of the stream based upon a predetermined relationship 
between the first exponential average, the second exponential average, and an alarm 
status indicator associated with the stream. 
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